Fix sandboxing support in NixOS

ocaml · Dec 10, 2024 · 6958205 · 6958205
1 parent 75f9eec
commit 6958205
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/state/shellscripts/bwrap.sh b/src/state/shellscripts/bwrap.sh
@@ -68,6 +68,10 @@ for dir in /*; do
     *) add_sys_mounts "$dir";;
     esac
 done
+# NOTE: This is required for NixOS (see https://github.com/NixOS/nixpkgs/pull/363770)
+if [ -d /run/current-system/sw ]; then
+  add_sys_mounts /run/current-system/sw
+fi
 
 mount_linked_cache() {
   local l_cache=$1